{"uuid": "78caef50-fc06-48ed-bc1b-71d8b5d95dba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34527", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb", "content": "{\"aliases\": [\"auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\"], \"arch\": \"x64, x86\", \"author\": [\"Zhiniang Peng\", \"Xuefeng Li\", \"Zhipeng Huo\", \"Piotr Madej\", \"Zhang Yunhai\", \"cube0x0\", \"Spencer McIntyre\", \"Christophe De La Fuente\"], \"autofilter_ports\": [139, 445], \"autofilter_services\": [\"netbios-ssn\", \"microsoft-ds\"], \"check\": true, \"default_credential\": false, \"description\": \"The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted\\n          DCERPC request, resulting in remote code execution as NT AUTHORITY\\\\SYSTEM. This module uses the MS-RPRN\\n          vector which requires the Print Spooler service to be running.\", \"disclosure_date\": \"2021-06-08\", \"fullname\": \"exploit/windows/dcerpc/cve_2021_1675_printnightmare\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"Print Spooler Remote DLL Injection\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"PrintNightmare\"], \"Reliability\": [\"unreliable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-service-down\"]}, \"path\": \"/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/dcerpc/cve_2021_1675_printnightmare\", \"references\": [\"CVE-2021-1675\", \"CVE-2021-34527\", \"URL-https://github.com/cube0x0/CVE-2021-1675\", \"URL-https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare\", \"URL-https://github.com/calebstewart/CVE-2021-1675/blob/main/CVE-2021-1675.ps1\", \"URL-https://github.com/byt3bl33d3r/ItWasAllADream\", \"ATT&CK-T1021.002\"], \"rport\": 445, \"session_types\": false, \"targets\": [\"Windows\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:17.623246Z"}